BAA fine print tracker
The clauses compliance officers ask about, side by side: liability, de-identified data and AI training, what happens to your data when you leave, how fast incidents are reported, and what's left out of coverage. "Not reviewed" means we haven't confirmed that term from the vendor's own documents yet. It doesn't mean the term is absent.
Not legal advice. These are suggested practices from a compliance team, not legal requirements. Vendor facts come from vendors' own pages on the date shown. Confirm current terms with each vendor and your counsel.
| Tool | Liability | De-identified data & AI training | Your data after you leave | Incident / breach reporting | Left out of coverage |
|---|---|---|---|---|---|
| MentalycSafe with BAA | BAA s.20 caps Mentalyc's total liability at $10,000. [source] | Never trains on session data. [source] | Audio deleted when the note is ready; anonymized transcript kept. [source] | Disclosures within 5 business days; breaches within 30 days. [source] | Not reviewed |
| UphealSafe with BAA | Subject to the limitations of liability in the main Agreement. [source] | May use de-identified, aggregated information to improve the app. [source] | Session audio auto-deleted once notes are ready. [source] | Not reviewed | Not reviewed |
| Hello PatientSafe with BAA | Governed by the main Agreement's limits. [source] | Won't use PHI to train, fine-tune or improve AI models without written authorization; may create de-identified data. [source] | Not reviewed | Not reviewed | Not reviewed |
| Pearl (Second Opinion)Safe with BAA | Pearl indemnifies the practice. [source] | Not reviewed | May retain radiological images after termination (s.III.3.2). [source] | Incidents reported within 3 business days. [source] | Not reviewed |
| OverjetSafe with BAA | Not reviewed | May use de-identified PHI to train Overjet's AI/ML algorithms. [source] | Not reviewed | Breaches reported within 5 business days. [source] | Not reviewed |
| AbridgeSafe with BAA | Not reviewed | May de-identify PHI. [source] | Return or destruction after termination is generally "not feasible" (s.4.4). [source] | Not reviewed | Not reviewed |
| Doximity GPTSafe with BAA | Not reviewed | May use and commercialize de-identified data, including for product development. [source] | Not reviewed | Not reviewed | Not reviewed |
| BlueprintSafe with BAA | Not reviewed | No AI training on clinic data "outside the provision of the Services"; may generate de-identified, aggregated data. [source] | Not reviewed | Not reviewed | Not reviewed |
| DeepCuraSafe with BAA | Not reviewed | No PHI for training; ToS allows aggregated/de-identified use to develop its technology. [source] | Evidence-audio retention can be turned off. [source] | Not reviewed | Not reviewed |
| SimplePractice Note TakerSafe with BAA | Not reviewed | From June 17, 2026, may keep de-identified transcripts to improve its AI (opt-outs available). [source] | Transcript available 7 days or until the note is locked. [source] | Not reviewed | Not reviewed |
| HeidiSafe with BAA | Not reviewed | BAA bars using PHI to train or improve AI models. [source] | Not reviewed | Not reviewed | Not reviewed |
| FreedSafe with BAA | Not reviewed | No PHI; trains on de-identified notes. [source] | Audio deleted after processing; notes deleted after 30 days. [source] | Not reviewed | Not reviewed |
| SukiSafe with BAA | Not reviewed | Trains on de-identified data. [source] | Audio and transcripts deleted after 30 days. [source] | Not reviewed | Not reviewed |
| Microsoft Dragon Copilot (formerly Nuance DAX)Unverified | Not reviewed | Models trained on anonymized data; limited human review by Microsoft staff/subprocessors. [source] | Audio, transcripts and flowsheet data kept up to 90 days. [source] | Not reviewed | Not reviewed |
| OpenEvidenceSafe with BAA | Not reviewed | No PHI for AI training; de-identified data may be used for any lawful purpose consistent with its policies. [source] | Not reviewed | Not reviewed | Not reviewed |
| AmbienceUnverified | Not reviewed | Privacy policy allows de-identified data to be shared with vendors and academic researchers. [source] | Not reviewed | Not reviewed | Not reviewed |
| Otter.aiSafe on specific plans only | Not reviewed | De-identifies audio/transcripts and trains its own models (Enterprise BAA). [source] | Not reviewed | Not reviewed | Not reviewed |
| Microsoft Copilot / Copilot Chat (work account)Safe with BAA | Not reviewed | Not used to train foundation models. [source] | Not reviewed | Not reviewed | Web-search queries to Bing. [source] |
| Gemini in Google WorkspaceSafe on specific plans only | Not reviewed | Not used to train outside your domain without permission. [source] | Not reviewed | Not reviewed | Gemini Notebook; third-party add-ons. [source] |
| ClaudeSafe on specific plans only | Not reviewed | Commercial data not used for training by default. [source] | Not reviewed | Not reviewed | Connectors, Skills, Claude in Chrome, cloud Cowork, beta features (Enterprise). [source] |
| ChatGPTSafe on specific plans only | Not reviewed | Business, Enterprise and API data not used for training by default. [source] | Not reviewed | Not reviewed | ChatGPT for Healthcare: improved memory, event-triggered tasks, Sites, Codex cloud. [source] |
| Zoom Workplace + AI CompanionSafe on specific plans only | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Some AI Companion features are unavailable to BAA customers. [source] |
| Slack AISafe on specific plans only | Not reviewed | Not reviewed | Not reviewed | Not reviewed | PHI allowed only in messages, files, file names and private channel/DM names. [source] |
| Fireflies.aiSafe on specific plans only | Not reviewed | Does not train on your data. [source] | Private Storage in a location you choose; must stay on for HIPAA. [source] | Not reviewed | Not reviewed |
Vendor facts checked 2026-10-16 on the vendor's own pages; each links to its source.
How to use this
Liability caps, training on de-identified data, and keeping data after termination can all be legal under HIPAA. They're still business risks your practice should knowingly accept or negotiate. Bring these rows to the vendor along with the due-diligence questions.
Get PHI-Safe AI updates by email
Signing up joins The VRC Newsletter from VanRein Compliance. It will include PHI-Safe AI updates (vendor BAA, training and retention changes) along with VanRein Compliance's other compliance news. You can unsubscribe any time.
Form not loading? Subscribe on newsletter.vanreincompliance.com.